Api serves files without a password